How to Fix CVE-2023-26077(8)- Two Critical 0-Day Vulnerabilities in Atera Windows Installers?

Abusing Windows software is the most common thing. However, the sad news is letting attackers abuse is also very common. Most likely this happens due to several reasons, some of them are lack of knowledge, poor security practices, ignoring security standers, and anything that gives a way for attackers to compromise. We will talk about one such instance in this post. Mandiant discovered two critical 0-day vulnerabilities in Atera Windows installer applications.

The vulnerabilities are given the identifiers CVE-2023-26077 and CVE-2023-26078, however their CVSS scores are not determined during the publish of this post. The first flaw could allow the attackers to execute arbitrary code execution as SYSTEM during the repair operation. The second flaw allows attackers to escalate privilege by spawning a command prompt window that further enables the attacker to perform tasks like opening a browser or file explorer with SYSTEM privileges.

Considering its impact, prevalence, and ease of exploitation, it is highly recommended to address these vulnerabilities. We published this post to discuss the impact caused by such third-party installers on Windows. Let’s see how to fix CVE-2023-26077(8), two critical 0-day vulnerabilities in Atera Windows installers. If you are interested to know how to fix these 0-Day vulnerabilities in Atera Windows installers, you can directly jump into the last section. Or, if you really know some technical details like how and what causes the vulnerability, please don’t skip anything. We will give you the complete information and background about these flaws.

Let’s begin this technical post by understanding arbitrary and remote code execution, privilege escalation attacks, MSI files in Windows, DLL libraries, and custom actions.

What are Privilege Escalation, Arbitrary, and Remote Code Execution Attacks?

Privilege escalation is a tactic attackers use to gain higher-level permissions on a system than they originally had access to. An external attacker may first exploit a vulnerability to gain a foothold as a regular, low-privilege user. Or an insider could start with standard user access. In either case, the attacker aims to elevate their privileges to administrator, root, or system-level access.

With heightened permissions, the attacker can access more sensitive data, disable security tools, modify system configurations, or fully take over the target. Escalation techniques include exploiting unpatched vulnerabilities, password cracking, abusing misconfigurations, or using malware. The defense relies on principles of least privilege, patching systems promptly, enforcing strong passwords, and locking down configurations. Monitoring for suspicious privilege changes is also key.

Arbitrary code execution is an attack that allows the running of malicious commands on a target system by exploiting flaws in software. When applications fail to properly validate or sanitize inputs, attackers can craft exploit code that gets interpreted as commands on the system. This could be done through inputs in a web form, processing files, or parsing network data.

Poor handling of errors and exceptions also opens the door for arbitrary code execution. The attacker can leverage these vulnerabilities to execute malware, delete or corrupt data, and fully compromise the system. Proper input validation and secure error handling are important defenses.

Remote code execution is similar, but the attacker’s malicious code executes over a network connection rather than locally. By finding vulnerabilities in network services, web applications, connected devices, and more, an attacker can send carefully crafted network packets that compromise the target. Remote code execution can lead to the installation of backdoors, data exfiltration, or complete system takeover. Timely patching, network segmentation, robust authentication, and monitoring help prevent remote attacks.

What are DLL libraries And What is DLL hijacking?

Dynamic link libraries (DLLs) are reusable code libraries in Windows. Instead of having large applications with all their code bundled together, functionality can be split out into separate DLL files. The DLLs contain compiled code to perform common functions that many programs can share. For example, the C runtime library DLL provides functions for input/output and string manipulation.